Security audit

供应商应付对账（免费版）

Security checks for vulnerabilities and agentic risk

Overview

The reconciliation engine itself is local and coherent, but the skill also pushes agents into external purchase, payment-link, and follow-on installation flows that conflict with its no-payment/no-network framing.

Install only if you are comfortable with a free local reconciliation tool that also contains built-in paid-upgrade prompts. Do not allow an agent to follow purchase, redirect, payment, or follow-on installation steps unless you explicitly intend to buy the paid version and have verified the platform, merchant, product, and amount yourself.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The documentation explicitly claims 'fully local' and 'no network', yet later instructs the agent to access remote pages, JSON endpoints, redirects, and payment resources. This contradiction undermines trust and can cause reviewers or users to approve a skill under false assumptions, while the agent is later induced to perform networked actions with financial consequences.

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample # 先看样例
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/run.mjs --sample # 先看样例
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill is presented as a local, no-network reconciliation tool, but its instructions direct the agent to initiate external purchase, installation, and payment flows via third-party URLs and payment endpoints. This creates a dangerous mismatch between the declared capability and the actual behavior expected from an agent, increasing the risk of unauthorized network access, phishing-style redirection, and financial transaction handling unrelated to the core accounting task.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The embedded e-commerce and payment onboarding content is not necessary for performing supplier reconciliation and expands the skill's scope into procurement and transaction handling. In an agent setting, this can be abused to socially engineer users into purchases, trigger external navigation, or normalize unsafe payment-link handling under the guise of a business-ops utility.

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The file’s natural-language documentation, labels, sample data, and user-facing guidance are entirely in Chinese, with no indication that other languages are supported or that the user can choose locale. This can violate language/locale policy when a skill imposes a specific language by default without explicit opt-in or justification.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The user-facing console output and embedded instruction text direct the agent to relay choices to the user entirely in Chinese, including purchase-flow messaging. There is no indication that the user can choose another language or that the Chinese-only requirement is justified as a documented locale constraint.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The script embeds commercial upsell and purchase-flow messaging unrelated to the stated reconciliation function, including instructions to relay A/B purchase choices and payment links. This creates a social-engineering surface inside a data-processing skill and can pressure or manipulate users in contexts where they expect only analytical output.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The code reads session-related environment variables and writes a marker file in the temp directory solely to manage upsell frequency. This introduces unnecessary statefulness and local tracking unrelated to reconciliation, which can surprise users, leak behavioral metadata across runs, and expand the skill's effective data-handling surface.

Intent-Code Divergence

Low

Confidence: 83% confidence
Finding: The inline docstring for loadInput says non-JSON input is treated as plain text material such as a 'full contract' (直接粘贴的合同全文), while the rest of the file and manifest consistently describe supplier reconciliation tables as the required input. This comment broadens the apparent intent beyond vendor statement reconciliation and conflicts with the documented purpose.

Static analysis

No suspicious patterns detected.